<html>


<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
<head>

<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
<link href="Boot%20sector_files/topic000.css" rel="stylesheet" type="text/css">
<title>Boot sector</title>
</head>

<body>

<h1>Boot sector</h1>

<p>The first sector of a logical drive is referred to as boot sector. It contains bootstrap code and information about drive geometry. Boot sector structure is determined by the architecture-related peculiarities of a specific file system.</p>

<p><strong>Table 1</strong>. Boot sector structure of a logical NTFS drive (short version)</p>

<p><img src="Boot%20sector_files/boot_010.gif"></p>

<p><strong>Note</strong> (the use of Data Extractor). The structure of any partition can be reviewed in the Partition map mode available from the right-click menu of the selected partition in the Explorer mode. You can use this mode for the following purposes: 

<ul>
  <li>Verify and correct the locations of metadata important for recovery of data within a partition while restoring the translator (copies of boot sector, FAT, MFT beginning, etc.).</li>
  <li>Check the location and integrity of the main partition metadata in case of logical corruption (fast access to boot sector copies and FAT tables).</li>
  <li>When working with a malfunctioning drive, you can select the chains most important for access to data (e.g., FATs, boot sectors) and read them to a copy using the strictest parameters (higher number of reading attempts), and estimate the quality of reading results. </li>
</ul>

<p>Window appearance in the Partition map mode is shown below.</p>

<h6><img src="Boot%20sector_files/boot_020.gif"></h6>

<h6>"Partition map" mode for an NTFS partition</h6>

<p>At the boot sector start there is a machine command of 3 bytes to proceed to bootstrap code. Bytes 3-11 (counted from zero) are used to store the vendor's ID that defines the type and version of the file system being used (e.g., "MSDOS5.0" for FAT16, "MSWIN4.0"/"MSWIN4.1" for FAT32 and "NTFS" for NTFS). </p>

<p>The identifier is followed by a BIOS Parameter Block (BPB) of 25 bytes used to store information about the drive geometry (the number of cylinders, heads, sectors, sector size, the number of sectors per cluster, etc.). </p>

<p>NTFS distributes drive space in clusters using 64 bits to number them. Thus it can use 2^64 clusters up to 64 Kb each. Similarly to FAT, cluster size can be changed but it does not have to grow proportionally to the drive size. Default cluster sizes selected during partition formatting are listed in the table below.</p>

<p><strong>Table 2.</strong> Default cluster sizes</p>

<p><img src="Boot%20sector_files/boot_030.gif"></p>

<p>The BIOS Parameter Block is followed by its extension - extended BPB used to store the number of the first MFT cluster, its size in clusters, the number of the MFT mirror cluster and some other information. Unlike FAT16/32, MFT can be located in any place on a drive. </p>

<p>The extended BPB is followed by Bootstrap Code, which searches a drive for the OS loader (in Windows&nbsp;NT it is ntldr), loads it into memory and passes control to it. If Bootstrap Code is missing, OS startup is impossible. However, if such drive is connected as a secondary one, the partition should be perfectly accessible.
</p>

<p>Boot sector ends with a 55AAh signature.</p>

<p><strong>Table 3</strong>. Boot sector structure of an NTFS drive</p>

<p><img src="Boot%20sector_files/boot_040.gif"></p>

<p><strong>Note! </strong>English parameters in this table correspond to the labels used in the program window while viewing a boot sector in binary editor in the NTFS Boot sector mode.</p>

<p><strong>Note!</strong>&nbsp; The ClustPerFileRecord parameter value can be calculated as follows. Some documents mention that parameter value equal to F6h means that the file record size is 1/4 of the cluster size (without explanation of calculation method for other values). We suggest the following formula for that parameter: </p>

<h6><img src="Boot%20sector_files/boot_050.gif">,</h6>

<blockquote>
  <p>where N stands for the size of file record in bytes.</p>
  <p><b>ClustPerIndexBlock </b>– is a single-byte number in true form (e.g., binary number 1111 0110 means minus 118 in decimal code, consequently the size of a file record is equal to 210 = 1024 bytes). Parameter values are always negative and the 0 … 31 range is illegal.</p>
</blockquote>

<p><b>Note</b> (the use of Data Extractor). For convenient viewing and editing of a boot sector of an NTFS partition, Data Extractor offers the window shown in the figure below. </p>

<p>Values in light fields of the form are essential for correct data recovery from the selected partition. The program validates the correctness of data input into these fields during entry. If the entered data are invalid, parameter title will be highlighted in yellow.</p>

<h6><img src="Boot%20sector_files/boot_060.gif"></h6>

<h6>Viewing a boot sector in the "NTFS Boot sector" mode</h6>

<p>You can open the window from the right-click menu of the boot sector mode in the Explorer mode (using the Properties menu item)  or the View as… / NTFS Boot sector mode of the binary editor. <br> <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> <br> <br> &nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp; <br> <br> <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>
</p>
</body>
</html>

<!-- This document saved from http://www.pc-3000flash.com/eng/help/help_information/ntfs/boot.htm -->
